Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.

The remote host is affected by the vulnerability described in GLSA-201705-08 (libav: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libav. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file in an application linked against libav, possibly resulting in       execution of arbitrary code with the privileges of the application, a       Denial of Service condition or access the content of arbitrary local       files.
  Workaround :

    There is no known workaround at this time.

NVD reports :

Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11 .4

The Mageia project reports :

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

ID	Name	Product	Family	Severity
100085	GLSA-201705-08 : libav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
85730	FreeBSD : ffmpeg -- use-after-free (da434a78-e342-4d9a-87e2-7497e5f117ba)	Nessus	FreeBSD Local Security Checks	medium
84171	Debian DSA-3288-1 : libav - security update	Nessus	Debian Local Security Checks	medium
83939	FreeBSD : avidemux26 -- multiple vulnerabilities in bundled FFmpeg (022255be-0895-11e5-a242-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-3417

high

Tenable Plugins

high

medium

medium

high